The Agent Skills Directory

[COMMAND_EXECUTION]: The skill operates by launching and communicating with a bundled helper binary named cmux-cua (and a nested helper application) located within the ~/Library/Application Support/cmux/cmux-cua/ directory. This binary is responsible for all accessibility tree inspection and UI interaction.
[PRIVILEGE_ESCALATION]: To function, the skill requires the user to grant high-privilege macOS permissions to the helper application, specifically 'Accessibility' (AXIsProcessTrusted) and 'Screen Recording' (CGPreflightScreenCaptureAccess). These permissions allow for full control over the user interface and the ability to capture screen content.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from untrusted sources (screenshots and accessibility trees of third-party apps and websites). This creates a surface where malicious content within those applications could attempt to influence the agent's behavior.
Ingestion points: Untrusted data enters the agent context through the get_app_state and get_window_state tools in the form of screenshots and UI metadata.
Boundary markers: The documentation does not specify the use of delimiters or 'ignore' instructions for the data returned from the GUI perception tools.
Capability inventory: The skill possesses significant capabilities including clicking, typing, dragging, and reading screen content, which could be abused if an injection succeeds.
Sanitization: While the skill includes 'obstruction-checking' for pixel clicks, there is no evidence of textual sanitization or filtering for instructions embedded within the application UI trees it processes.

cmux-cua